SE API: SE Manager and Reader implementation

- Introduce an interface for developers to write reader driver
(core/include/tee/se/reader/interface.h)
- A sample reader driver implementation: PC/SC

SE API: SE Manager and Reader implementation

- Introduce an interface for developers to write reader driver
(core/include/tee/se/reader/interface.h)
- A sample reader driver implementation: PC/SC passthru reader
(core/tee/se/reader/passthru_reader)
- Currently supported machine is qemu-virt (compile with --with-pcsc-passthru)
- A selftest STA is included to test the functionality of SE Reader
(core/arch/arm32/sta/se_api_self_tests.c)
- To enable SE API, add "WITH_SE_API := y" in your platform config

Signed-off-by: SY Chiu <sy.chiu@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Tested-by: SY Chiu <sy.chiu@linaro.org> (Modified QEMU + jcardsim)

show more ...

Introduce a Linux style initcall mechanism

To use it, simply add something like:

service_init(server_init_callback);

The callback regsitered will be invoked at the end of init_teecore().
Now we ha

Introduce a Linux style initcall mechanism

To use it, simply add something like:

service_init(server_init_callback);

The callback regsitered will be invoked at the end of init_teecore().
Now we have 2 priority service_init and driver_init. The callback
regsitered in service level will be invoked first.

Signed-off-by: SY Chiu <sy.chiu@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Tested-by: SY Chiu <sy.chiu@linaro.org> (QEMU)

show more ...

SHA-1 ARMv8 crypto extension implementation

* Adds a ARMv8 crypto extension based SHA-1 implementation for LTC.
* Crypto extension based SHA-1 implementation is enabled for
plat-vexpress-juno.

Si

SHA-1 ARMv8 crypto extension implementation

* Adds a ARMv8 crypto extension based SHA-1 implementation for LTC.
* Crypto extension based SHA-1 implementation is enabled for
plat-vexpress-juno.

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Tested-by: Jens Wiklander <jens.wiklander@linaro.org> (Juno)
Reviewed-by: Pascal Brand <pascal.brand@linaro.org>
Tested-by: Pascal Brand <pascal.brand@linaro.org> (STM platform)

show more ...

SHA-256 ARMv8 crypto extension implementation

* Adds a ARMv8 crypto extension based SHA-256 implementation for LTC.
* Crypto extension based SHA-256 implementation is enabled for
plat-vexpress-ju

SHA-256 ARMv8 crypto extension implementation

* Adds a ARMv8 crypto extension based SHA-256 implementation for LTC.
* Crypto extension based SHA-256 implementation is enabled for
plat-vexpress-juno.

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Pascal Brand <pascal.brand@linaro.org>

show more ...

arm32: support for VFP/NEON operations.

CFG_WITH_VFP=y enables use of VFP/NEON by context switching VFP state on
demand.

plat-vexpress: specific initialization of CPACR to allow CP10 and CP11
acces

arm32: support for VFP/NEON operations.

CFG_WITH_VFP=y enables use of VFP/NEON by context switching VFP state on
demand.

plat-vexpress: specific initialization of CPACR to allow CP10 and CP11
access to allow usage of VFP/NEON operations.

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Pascal Brand <pascal.brand@linaro.org>

show more ...

plat-vexpress: config nsacr

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Pascal Brand <pascal.brand@linaro.org>

Add PKCS #5 v2.0 key derivation function 2 (PBKDF2)

This commit implements a crypto extension to support the key derivation
function defined in section 5.2 of RFC 2898
(https://www.ietf.org/rfc/rfc2

Add PKCS #5 v2.0 key derivation function 2 (PBKDF2)

This commit implements a crypto extension to support the key derivation
function defined in section 5.2 of RFC 2898
(https://www.ietf.org/rfc/rfc2898.txt), which is a re-publish of PKCS #5 v2.0.
The underlying pseudorandom function is HMAC-SHA1, which is the default PRF
specified in the RFC. It would be trivial to support the other HMAC functions
already implemented in OP-TEE.

See documentation/extensions/crypto_pbkdf2.md for details.

Tested on PLATFORM=vexpress-qemu_virt with the test vectors from RFC 6070
(https://www.ietf.org/rfc/rfc6070.txt).

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Xiaoqiang Du <xiaoqiang.du@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Pascal Brand <pascal.brand@linaro.org>
Tested-by: Pascal Brand <pascal.brand@linaro.org> (STM platform)

show more ...

Add HMAC-based extract-and-expand key derivation function (HKDF)

HKDF (http://tools.ietf.org/html/rfc5869) is a key derivation algorithm.
As per the RFC:

A key derivation function (KDF) is a bas

Add HMAC-based extract-and-expand key derivation function (HKDF)

HKDF (http://tools.ietf.org/html/rfc5869) is a key derivation algorithm.
As per the RFC:

A key derivation function (KDF) is a basic and essential component of
cryptographic systems. Its goal is to take some source of initial
keying material and derive from it one or more cryptographically
strong secret keys.
[...]
HKDF follows the "extract-then-expand" paradigm, where the KDF
logically consists of two modules.
[...]
The goal of the "extract" stage is to "concentrate" the possibly
dispersed entropy of the input keying material into a short, but
cryptographically strong, pseudorandom key.
[...]
The second stage "expands" the pseudorandom key to the desired
length; the number and lengths of the output keys depend on the
specific cryptographic algorithms for which the keys are needed.

Since HKDF is not covered by the GlobalPlatform Internal API specification
v1.0/v1.1, this commit introduces extensions to the specification.
More specifically: it defines new algorithms, a new object type and new
object attributes. This implementation supports all the usual hash
functions (MD5, SHA-1, SHA-224, SHA-256, SHA-384, SHA-512) and may
produce output keys of length up to 4096 bits (currently limited only by
the maximum size allowed for an object of type TEE_TYPE_GENERIC_SECRET).
Aside from minor updates to object manipulation functions to support
the new data, the function TEE_DeriveKey() is mostly impacted.

The file documentation/extensions/crypto_hkdf.md contains the modifications
to the GP Internal API v1.0 spec in order to support HKDF.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Xiaoqiang Du <xiaoqiang.du@linaro.org>
Reviewed-by: Pascal Brand <pascal.brand@linaro.org>
Tested-by: Pascal Brand <pascal.brand@linaro.org> (STM platform)
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>

show more ...

Add Concat KDF (Concatenation Key Derivation Function, NIST SP 800-56A R1)

Concat KDF is a key derivation algorithm defined in section 5.8.1 of
the NIST Special Publication 800-56A Revision 1, "Reco

Add Concat KDF (Concatenation Key Derivation Function, NIST SP 800-56A R1)

Concat KDF is a key derivation algorithm defined in section 5.8.1 of
the NIST Special Publication 800-56A Revision 1, "Recommendation for Pair-Wise
Key Establishment Schemes Using Discrete Logarithm Cryptography"
(http://csrc.nist.gov/publications/nistpubs/800-56A/SP800-56A_Revision1_Mar08-2007.pdf)

This is a TEE implementation of the function, which supports the following
hash algorithms: SHA-1, SHA-224, SHA-256, SHA-384 and SHA-512.
The actual key derivation is implemented in TEE_DeriveKey() thanks to
custom extensions to the GlobalPlatform API v1.0. Please refer to
documentation/extensions/crypto_concat_kdf.md for details.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Xiaoqiang Du <xiaoqiang.du@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Pascal Brand <pascal.brand@linaro.org>
Tested-by: Pascal Brand <pascal.brand@linaro.org> (STM platform)

show more ...

Add A80 platform support to .travis.yml

Signed-off-by: sunny <sunny@allwinnertech.com>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Revie

Add A80 platform support to .travis.yml

Signed-off-by: sunny <sunny@allwinnertech.com>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Pascal Brand <pascal.brand@linaro.org>
Tested-by: Pascal Brand <pascal.brand@linaro.org> (STM platform)
Tested-by: sunny <sunny@allwinnertech.com> (Allwinner A80 platform)

show more ...

Add Allwinner a80 board description to README.md

Signed-off-by: sunny <sunny@allwinnertech.com>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.o

Add Allwinner a80 board description to README.md

Signed-off-by: sunny <sunny@allwinnertech.com>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Pascal Brand <pascal.brand@linaro.org>

show more ...

Add plat-sunxi

Initial version support for Allwinner A80 platform.
Allwinner A80 is big.little archtecture with 4*A7 + 4*A15,
Support Trustzone tech and secureboot inside hardware.
plat-sunxi suppor

Add plat-sunxi

Initial version support for Allwinner A80 platform.
Allwinner A80 is big.little archtecture with 4*A7 + 4*A15,
Support Trustzone tech and secureboot inside hardware.
plat-sunxi support features:
1.Clone plat-sunxi from plat-vexpress;
2.Secure bootloader reserved 64MB secure DRAM for optee_os;
3.Support SMP secondary cpu secure stage bootup;
4.Add uart driver to core/driver/*;
5.Support GIC driver initialization.
The porting work test on Optimus board, with allwinner A80 chip.

Signed-off-by: sunny <sunny@allwinnertech.com>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Pascal Brand <pascal.brand@linaro.org>

show more ...

driver/gic: add gic_cpu_init interface.

The interface mainly use for secondary cpu bootup.
When secondary cpu bootup, It will initialize per-cpu gic-cpu-interface.
The gic_cpu_init main work include

driver/gic: add gic_cpu_init interface.

The interface mainly use for secondary cpu bootup.
When secondary cpu bootup, It will initialize per-cpu gic-cpu-interface.
The gic_cpu_init main work include:
1.Set the per-cpu interrupts as Group1;
2.Enable Group0-interrupts/Group1-interrupts/FIQEn.

Signed-off-by: sunny <sunny@allwinnertech.com>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Pascal Brand <pascal.brand@linaro.org>

show more ...

Fix #6686: Support passing Public Exponent when generating RSA key pair

Global Platform Internal API 1.0 is not accurate when describing
RSA key pair generation. It only indicates
No parameter i

Fix #6686: Support passing Public Exponent when generating RSA key pair

Global Platform Internal API 1.0 is not accurate when describing
RSA key pair generation. It only indicates
No parameter is required
This is why RSA key pair generation was always using 65537
as the public exponent.

Version 1.1 of the API is much more precise:
No parameter is required.
The TEE_ATTR_RSA_PUBLIC_EXPONENT attribute may be
specified; if omitted, the default value is 65537.

This patch implements this requirement.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Tested-by: Pascal Brand <pascal.brand@linaro.org> (STM platform)
Reviewed-by: Laurent GERARD <laurent.gerard@st.com>
Reviewed-by: Jean-Michel DELORME <jean-michel.delorme@st.com>
Signed-off-by: Pascal Brand <pascal.brand@st.com>

show more ...

ta_dev_kit.mk: get platform-specific flags from platform_flags.mk

Platform-specific flags that apply to user-mode code are moved from
from core/arch/$(ARCH)/plat-$(PLATFORM)/conf.mk to a new file:
c

ta_dev_kit.mk: get platform-specific flags from platform_flags.mk

Platform-specific flags that apply to user-mode code are moved from
from core/arch/$(ARCH)/plat-$(PLATFORM)/conf.mk to a new file:
core/arch/$(ARCH)/plat-$(PLATFORM)/platform_flags.mk.

This file is used by ta/mk/ta_dev_kit.mk so that the Trusted Applications
are built with the same flags used when building the user-mode TEE code.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

core: get value of CFG_ variables directly from generated/conf.h

Add a '-include' preprocessor flag to the command line so that all
TEE core files include generated/conf.h automatically. Then, there

core: get value of CFG_ variables directly from generated/conf.h

Add a '-include' preprocessor flag to the command line so that all
TEE core files include generated/conf.h automatically. Then, there
is no need to define macros via the command line (-DCFG_XYZ=...).

This commit also fixes a compile error when
CFG_TEE_CORE_EMBED_INTERNAL_TESTS=0.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Pascal Brand <pascal.brand@linaro.org>
Tested-by: Pascal Brand <pascal.brand@linaro.org> (STM platform)

show more ...

pager documentation

Updates the pager section of the OP-TEE design document with a
description of the pager.

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Joakim Bech <joak

pager documentation

Updates the pager section of the OP-TEE design document with a
description of the pager.

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Pascal Brand <pascal.brand@linaro.org>

show more ...

Update QEMU and FVP scripts for optee_test / xtest

Since we now have official support for xtest, we have updated our two
setup scripts for QEMU and FVP to make use of the new git called
optee_test.g

Update QEMU and FVP scripts for optee_test / xtest

Since we now have official support for xtest, we have updated our two
setup scripts for QEMU and FVP to make use of the new git called
optee_test.git.

Signed-off-by: Joakim Bech <joakim.bech@linaro.org>
Tested-by: Joakim Bech <joakim.bech@linaro.org> (QEMU and FVP)
Reviewed-by: Pascal Brand <pascal.brand@linaro.org>

show more ...

Align plat-stm and plat-vexpress versions of core_bootcfg.c

Signed-off-by: Pascal Brand <pascal.brand@st.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Tested-by: Pascal Brand <pascal.

Align plat-stm and plat-vexpress versions of core_bootcfg.c

Signed-off-by: Pascal Brand <pascal.brand@st.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Tested-by: Pascal Brand <pascal.brand@linaro.org> (STM platform)

show more ...

plat-stm: move memory definition in platform_config.h

Signed-off-by: Pascal Brand <pascal.brand@st.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

plat-stm: rename memory definition name

Rename following memory area definition name, according
to the one used in vexpress:
CFG_DDR_START into DRAM0_BASE
CFG_DDR_SIZE

plat-stm: rename memory definition name

Rename following memory area definition name, according
to the one used in vexpress:
CFG_DDR_START into DRAM0_BASE
CFG_DDR_SIZE into DRAM0_SIZE
CFG_DDR1_START into DRAM1_BASE
CFG_DDR1_SIZE into DRAM1_SIZE
CFG_DDR_ARM_ARMTZ_START into CFG_SHMEM_START
CFG_DDR_ARM_ARMTZ_SIZE into CFG_SHMEM_SIZE
CFG_DDR_ARMTZ_ONLY_START into TZDRAM_BASE
CFG_DDR_ARMTZ_ONLY_SIZE into TZDRAM_SIZE

Signed-off-by: Pascal Brand <pascal.brand@st.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

plat-stm: make stacks cache line aligned

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Pascal Brand <pascal.brand@linaro.org>
Tested-by: Pascal Brand <pascal.brand@linaro.or

plat-stm: make stacks cache line aligned

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Pascal Brand <pascal.brand@linaro.org>
Tested-by: Pascal Brand <pascal.brand@linaro.org> (STM platform)

show more ...

arm32: remove memmap_notinit bookkeeping

Removes the bookkeeping of whether memory map has been initialized or
not using the memmap_notinit variable. Memory map is always initialized
before any core

arm32: remove memmap_notinit bookkeeping

Removes the bookkeeping of whether memory map has been initialized or
not using the memmap_notinit variable. Memory map is always initialized
before any core_va2pa() or core_pa2va() is performed so the bookkeeping
doesn't do much good.

The variable was updated with caches disabled while other CPUs might have
caches enabled. This can result in unexpected problems.

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Tested-by: Jens Wiklander <jens.wiklander@linaro.org> (Juno)
Reviewed-by: Pascal Brand <pascal.brand@linaro.org>

show more ...

plat-vexpress: make stacks cache line aligned

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Pascal Brand <pascal.brand@linaro.org>

Shared memory documentation

Signed-off-by: Pascal Brand <pascal.brand@st.com>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-b

Shared memory documentation

Signed-off-by: Pascal Brand <pascal.brand@st.com>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...